If a hacker gets into your WordPress admin account, the game is basically over.
They don’t need fancy malware first. They don’t need some movie-style hack screen. They just log in like a normal user, click around, install what they want, create hidden accounts, and quietly make a mess. Sometimes they even sit there for weeks before anyone notices. Nasty.
And honestly, a lot of these break-ins happen because of small admin account mistakes. Very ordinary stuff. A reused password. Too many admin users. An old freelancer account nobody removed. That kind of thing.
If you run a small business site, this is good news in a weird way. Why? Because these problems are fixable without turning into a security expert.
Why admin accounts matter so much
Your WordPress admin account is the master key.
With admin access, someone can change pages, reset passwords, upload files, install plugins, edit theme code, redirect visitors, and lock you out of your own website. If your site takes bookings, collects leads, or runs WooCommerce, the damage gets expensive fast. Lost sales. Angry customers. Weird spam pages showing up in Google three weeks later.
I’ve seen small business sites with decent hosting and decent plugins still get compromised because one admin login was weak. That’s all it took.
So yes, plugin updates matter. Hosting matters. Backups matter. But if your admin accounts are sloppy, you’re leaving the front door open and arguing about the curtains.
Mistake #1: keeping the default username
If your username is admin, administrator, your company name, or your own email address shown publicly on the site, you’re making a bot’s job easier.
Attackers love predictable usernames. They don’t want to guess two things if they can guess one. And a lot of automated attacks start by trying common usernames over and over until one works.
Use a username that’s boring and hard to predict. Not your business name. Not your first name. Not the email address from your contact page.
If you’re stuck with an old admin username, don’t just ignore it forever. Create a new administrator account with a less obvious username, log in with that, then delete the old one and reassign the content. Takes a few minutes.
If you want a deeper walkthrough for the login side of this, this guide on securing the WordPress login page is a good place to start.
Mistake #2: weak passwords, or worse, recycled ones
This one sounds obvious. People still do it.
A password like Summer2024! or CompanyName123 feels stronger than it is. And if that same password is also used for your email, Facebook page, Canva account, or some old invoicing tool from 2021, you’ve created a chain reaction. One leak somewhere else, and your WordPress admin is suddenly exposed too.
Use a password manager. Really. Even a basic one is better than trying to invent clever passwords in your head.
Good admin passwords should be:
- long – 16 characters or more is a good start
- unique – never reused anywhere else
- random – not based on your business name, pet, or street
And don’t send admin passwords over email or WhatsApp if you can avoid it. That’s how credentials end up floating around forever.
Mistake #3: too many administrator accounts
This is a classic small business problem. You hired a developer, then a marketing person, then a freelancer for SEO, then your cousin helped upload products once, and now there are six admin accounts on a site that really needs maybe two.
Big mistake.
Every admin account is another door. Another password. Another chance for someone to get phished, reuse credentials, or leave behind an insecure setup.
Most users do not need administrator access. They just don’t. A shop manager might need Editor. A content person might need Author. Someone adding products to WooCommerce probably doesn’t need permission to install plugins or change security settings.
Take ten minutes and review your users page. Ask one question for each account: does this person still need access, and do they need admin access?
Usually the answer is no.
Mistake #4: leaving old accounts active after people leave
This one causes real trouble because it feels harmless. An employee leaves. A freelancer finishes the project. A web agency built the site two years ago and nobody touched the user list after that.
But those accounts stay there. Quietly.
Maybe the password never changed. Maybe the email on the account is tied to a domain you don’t control anymore. Maybe that old freelancer reused the same password on 20 sites. You don’t know. That’s the problem.
Any account that no longer needs access should be removed, not just ignored.
Here’s the simple cleanup routine:
- Go to Users in WordPress
- List every account with admin access
- Delete the ones no longer needed
- Downgrade accounts that don’t need full control
- Change passwords for any shared or uncertain accounts
If your site has been passed between multiple developers over the years, do this today. Not next month.
Mistake #5: no two-factor authentication
Passwords alone aren’t enough anymore. Sad, but true.
Two-factor authentication means a password by itself won’t let someone in. They also need a code from your phone or authentication app. That extra step blocks a huge number of real-world break-ins, especially the boring automated ones that hit small business sites all day.
And before you think it’ll be annoying – for most people it’s about ten extra seconds during login. That’s a pretty good trade.
If your site doesn’t have it yet, add two-factor authentication for every administrator account first. Editors and shop managers too, if they have sensitive access. Honestly, most people should enable it on day one and never think about it again.
If you need help understanding the basics, this article on why every WordPress admin needs 2FA explains it in plain English.
Mistake #6: sharing one admin login between multiple people
Please don’t do this. Yet people do. Alot.
Maybe the username is just officeadmin and three people know the password. It feels easy. It is easy. It’s also a security and maintenance nightmare.
If something goes wrong, you can’t tell who logged in and changed what. If one person leaves, you have to change the password for everyone. If that password gets exposed, every person using it is now part of the problem.
Each real person should have their own account. Their own role. Their own login history. Cleaner, safer, simpler.
Mistake #7: ignoring login protection and activity logs
A lot of owners only think about accounts when someone gets locked out. That’s backwards.
You want warning signs before things go bad. Failed login attempts. New admin accounts being created. Plugin installs you didn’t approve. File changes at odd hours. That’s the kind of stuff that gives you a chance to react early instead of cleaning up a hacked site later.
That’s also why ongoing WordPress maintenance matters so much. Updates are part of it, sure, but so is keeping an eye on user accounts, login activity, and weird changes that don’t make sense. Left alone, small account issues turn into expensive ones.
What you should do this week
You don’t need a giant security project. Start with the admin accounts.
Do these five things:
- remove any unused administrator accounts
- change weak or reused passwords
- turn on 2FA for admins
- replace shared logins with individual user accounts
- check that each user has the lowest role they actually need
That’s it. Not glamorous, but it works.
Small business website security is usually about reducing stupid risk. I don’t mean that harshly. Just plainly. Most attacks aren’t personal. They’re automated, lazy, and opportunistic. Hackers jiggle the handle. If the door opens, they walk in.
So don’t hand them the keys.
Lock down your admin accounts, clean up old access, and make login security a normal part of running the site. A few small fixes now can save you from a miserable weekend later trying to figure out why your homepage suddenly redirects to a fake casino.